Inferring security-sensitive entities in libraries

A system for analyzing a software library, comprising:

• a processor;
• a memory comprising instructions that, when executed by the processor, cause the processor to:
• obtain the software library;
• identify a candidate security-sensitive entity in the software library;
• generate a control flow graph comprising a plurality of execution paths, each execution path comprising a public entry node corresponding to a public entry and a candidate security-sensitive entity node corresponding to the candidate security-sensitive entity, wherein the public entry is a point where an application program external to the software library accesses the software library;
• determine whether each execution path in the control flow graph further comprises a permission check node between the respective public entry node and the candidate security-sensitive entity node in the respective execution path, wherein the permission check node corresponds to a permission check in the software library that checks a value of a permission that controls access to a resource of the system;
• calculate a coverage level for the candidate security-sensitive entity node relative to the permission check node, wherein the determination is based on the coverage level exceeding a predetermined value;
• and
• classify, based on the determination, the candidate security-sensitive entity as a security-sensitive entity;
• and
• a repository, configured to store at least the software library and the application program.

A non-transitory computer readable medium comprising instructions that, when executed by a processor, perform a method for analyzing a software library, the method comprising:

• obtaining the software library;
• identifying a candidate security-sensitive entity in the software library;
• generating a control flow graph comprising a plurality of execution paths, each execution path comprising a public entry node corresponding to a public entry and a candidate security-sensitive entity node corresponding to the candidate security-sensitive entity, wherein the public entry is a point where an application program external to the software library accesses the software library;
• determining whether each execution path in the control flow graph further comprises a permission check node between the respective public entry node and the candidate security-sensitive entity node in the respective execution path, wherein the permission check node corresponds to a permission check in the software library that checks a value of a permission that controls access to a resource of a computer system comprising the software library;
• calculating a coverage level for the candidate security-sensitive entity node relative to the permission check node, wherein the determination is based on the coverage level exceeding a predetermined value;
• and
• classifying, based on the determination, the candidate security-sensitive entity as a security-sensitive entity.